Fix encrypted email recipient can't open message

You got an encrypted email but you can't open it. The message says something like "cannot decrypt" or "digital signature invalid." This happens more often than you think. Let's fix it.

The real fix is almost always one of three things. I'll start with the most common one. Then we go to number two and three. Each section has step-by-step instructions.

1. You don't have the sender's certificate

This is the number one reason. The person who sent the email encrypted it with their public key. Your email program needs that same public key to decrypt it. Without it, the message stays scrambled.

Here's what to do:

1. Ask the sender to email you their digital certificate. They should go to their email settings and export their certificate as a .cer or .p7b file.
2. Save that file to your desktop.
3. Open your email program. If you're using Outlook (2016, 2019, or Microsoft 365), go to File > Options > Trust Center > Trust Center Settings.
4. Click Email Security. Under Digital IDs (Certificates), click Import.
5. Browse to the .cer or .p7b file you saved. Click Open.
6. You'll see a certificate details screen. Click Next, then Finish.
7. Close all Outlook windows and reopen the encrypted email. After reopening, you should see the message content normally.

After step 6, you should see a confirmation pop-up saying "The import was successful." If you don't see that, the file might be corrupted. Ask the sender to re-export and send again.

One more thing: if the sender used a self-signed certificate (common with S/MIME), your email client might still warn you about trust. That's fine. You can click "View Certificate" and choose "Trust this certificate." The message will open.

2. The certificate is expired

Digital certificates have an expiration date. Most are valid for 1 to 3 years. If the sender's certificate expired, you can't decrypt the email. The error message usually says something like "The certificate used to encrypt this message has expired."

Here's how to check and fix:

1. Open the encrypted email. Don't try to decrypt it yet.
2. Look for a digital signature icon or a lock icon. In Outlook, it's usually at the top of the message. Right-click it and choose View Details.
3. You'll see the certificate information. Look for the Valid from and Valid to dates. If the current date is past the Valid to date, it's expired.
4. You can't fix an expired certificate on your end. The sender needs to get a new certificate and re-encrypt the message.
5. Ask the sender to renew their certificate from their email provider or a service like DigiCert, GlobalSign, or Let's Encrypt (if they use S/MIME). Then ask them to re-send the encrypted email.
6. If you have the old certificate installed, remove it first. Go to Windows Certificates manager: press Windows key + R, type certmgr.msc, and press Enter. Find the expired certificate under Personal or Other People. Right-click it and choose Delete. Then install the new one as shown in section 1.

After the sender re-sends the email with the new certificate, you should be able to open it. The lock icon will turn solid, and the message will appear.

3. You're using the wrong email client

Not all email clients work with encryption. If you're using a web browser (like Gmail in Chrome) to open an S/MIME encrypted email, it won't work. S/MIME requires a local email client with certificate support.

Here's what works:

• Outlook (desktop version, not web): works with S/MIME. Outlook for Mac also works but needs a separate certificate setup.
• Thunderbird: works with S/MIME and PGP (GnuPG).
• Apple Mail: works with S/MIME on macOS.
• Gmail web: doesn't work with S/MIME unless you use Gmail's built-in encryption (which is S/MIME only for Google Workspace accounts, and it's different).

If you're using a webmail client, switch to a desktop client. Here's how to do that quick:

1. If you have Outlook on your computer, open it. Add your email account: File > Add Account. Enter your email address and password. Outlook will set it up automatically for most providers (Gmail, Outlook.com, Office 365).
2. Wait for the initial sync. It might take a few minutes. After that, find the encrypted email in your inbox.
3. Double-click the email. If you have the certificate installed (section 1), it will decrypt and open.

If you don't have Outlook, download Thunderbird for free from thunderbird.net. It handles S/MIME and PGP encryption well. After installing, add your email account under File > New > Existing Mail Account. Enter your name, email, and password. Thunderbird will detect settings automatically for most providers.

After the switch, test by asking a colleague to send you a simple test encrypted email. If it opens, you're good. If not, the problem is likely the certificate (go back to section 1).

Quick-reference summary table